ADFS 3.0 Extranet Lockout - UDP 389

[Matt Hudson]

Hi,

We've got quite a complex setup, a central domain containing ADFS 3.0 and then many two way trusts to other domains all over the globe connected either by site-to-site VPN's and ExpressRoute.

I am tryng to enable the Extranet Lockout feature and before I do this I'm aware that I need to be able to query the remote PDC on port 389 UDP, this is proving a nightmare in terms of firewall access.  TCP is usually fine but getting UDP access can be tricky and some sites have disabled IPv6 for security reasons. I know this is a bad move but we can only advice them unfortuantely.

So, what can I do about this?  Can you force ExtranetLockout to use TCP?  I'm aware that the incoming version of ADFS has some changes on this front particularly about not needing access to the PDC but is there anything I can do itn the meantime and will the new version rely solely on TCP?

Thanks for any input,

Matt

[#2]

This isn't going to be possible, I don't believe. LDAP Ping, specifically, happens over UDP, which will get in your way. It's UDP, so if security are paranoid, surely they can inspect the packets as they go through to check that there's nothing nefarious occurring?